Rather than speculate, just read the letter, it says they suspect they have contravened sections 32 and 81:
Anti-Money Laundering and Counter-Terrorism Financing Act 2006
https://www.legislation.gov.au/Details/C2019C00011
section 32:
32 Carrying out the applicable customer identification procedure before the commencement of the provision of a designated service.
(1) A reporting entity must not commence to provide a designated service to a customer if:
(a) there are no special circumstances that justify carrying out the applicable customer identification procedurein respect of the customerafter the commencement of the provision of the service (see section 33); and
(b) the reporting entity has not previously carried out the applicable customer identification procedure in respect of the customer; and
(c) neither section 28 nor section 30 applies to the provision of the service.
Note 1: See also the definition ofcommence to provide a designated servicein section 5.
Note 2: See also section 38 (when applicable customer identification procedure deemed to be carried out by a reporting entity).
Civil penalty
(2) Subsection (1) is a civil penalty provision.
section 81:
81 Reporting entity must have an anti‑money laundering and counter‑terrorism financing program
(1) A reporting entity must not commence to provide a designated service to a customer if the reporting entity:
(a) has not adopted; and
(b) does not maintain;
an anti‑money laundering and counter‑terrorism financing program that applies to the reporting entity.
Civil penalty
(2) Subsection (1) is a civil penalty provision.
